In-memory database for multi-tenancy

ABSTRACT

An in-memory database server hosting a tenant of a multi-tenant software architecture can receive a definition of a custom data field that is unique to an organization having isolated access to the tenant. The custom data field can extend a standard table defined by central metadata stored at a system tenant of the multi-tenant software architecture. Tenant private metadata that includes the definition can be stored in memory accessible only to the tenant. A tenant-dependent table that includes the custom data field can be formed, for example by retrieving central metadata defining the standard table from the system tenant and adding the custom data field using the definition. The tenant-dependent table can be presented for access via a database client at the organization. Related systems, articles of manufacture, and computer-implemented methods are disclosed.

TECHNICAL FIELD

The subject matter described herein relates to the used of in-memorydatabase technology in conjunction with a multi-tenant software deliveryarchitecture.

BACKGROUND

Various organizations make use of enterprise resource planning (ERP)software architectures to provide an integrated, computer-based systemfor management of internal and external resources, such as for exampletangible assets, financial resources, materials, customer relationships,and human resources. In general, an ERP software architecture isdesigned to facilitate the flow of information between businessfunctions inside the boundaries of the organization and manage theconnections to outside service providers, stakeholders, and the like.Such architectures often include one or more centralized databasesaccessible by a core software platform that consolidates businessoperations, including but not limited to those provided by third partyvendors, into a uniform and organization-wide system environment. Thecore software platform can reside on a centralized server oralternatively be distributed across modular hardware and software unitsthat provide “services” and communicate on a local area network or overa network, such as for example the Internet, a wide area network, alocal area network, or the like.

As part of the installation process of the core software platform oncomputing hardware owned or operated by the organization, one or morecustomized features, configurations, business processes, or the like maybe added to the default, preprogrammed features such that the coresoftware platform is configured for maximum compatibility with theorganization's business processes, data, and the like.

The core software platform of an ERP software architecture can beprovided as a standalone, customized software installation that runs onone or more processors that are under the control of the organization.This arrangement can be very effective for a large-scale organizationthat has very sophisticated in-house information technology (IT) staffand for whom a sizable capital investment in computing hardware andconsulting services required to customize a commercially available ERPsolution to work with organization-specific business processes andfunctions is feasible. Smaller organizations can also benefit from useof ERP functionality. However, such an organization may lack thenecessary hardware resources, IT support, and/or consulting budgetnecessary to make use of a standalone ERP software architecture productand can in some cases be more effectively served by a software as aservice (SaaS) arrangement in which the ERP system architecture ishosted on computing hardware such as servers and data repositories thatare maintained remotely from the organization's location and accessed byauthorized users at the organization via a thin client, such as forexample a web browser, over a network.

SUMMARY

In one aspect, a computer-implemented method includes receiving, at anin-memory database server hosting a tenant of a multi-tenant softwarearchitecture, a definition of a custom data field that is unique to anorganization having isolated access to the tenant. The custom data fieldextends a standard table defined by central metadata stored at a systemtenant of the multi-tenant software architecture. Tenant privatemetadata that includes the definition are stored in memory accessibleonly to the tenant. A tenant-dependent table that includes the customdata field is form. The forming includes retrieving, from the systemtenant, central metadata defining the standard table and adding thecustom data field using the definition. The tenant-dependent table ispresented for access via a database client at the organization.

In some variations one or more of the following can optionally beincluded. A second definition of a customized tenant private table thatis unique to the tenant can be received at the in-memory databaseserver. Additional tenant private metadata that include the seconddefinition can be stored in the memory accessible only to the tenant,and the tenant private table can be presented for access via thedatabase client at the organization. The multi-tenant softwarearchitecture can include a plurality of tenants hosted at a backendsystem. Each tenant of the plurality of tenants can include its owndedicated in-memory database server having unique access totenant-specific data. At least one of the plurality of database serverscan be provided via each of a plurality of hosts on the backend system.The plurality of database servers can share the central metadata of thesystem tenant. The system tenant can include a central metadata masterdatabase server responsible for creating and maintaining the centralmetadata. Each host of the plurality of hosts can include a localmetadata master database server that receives a copy of the centralmetadata from the central metadata master database server. An updateddefinition of a tenant dependent table that is available to all of theplurality of tenants can be received at the central metadata masterdatabase server. New central metadata that include the updateddefinition can be stored in a system tenant memory accessible only tothe system tenant. The new central metadata can be propagated to eachlocal metadata master database server for use by the plurality oftenants.

It should be noted that, while the descriptions of specificimplementations of the current subject matter discuss delivery ofenterprise resource planning software to multiple organizations via amulti-tenant system, the current subject matter is applicable to othertypes of software and data services access as well. The scope of thesubject matter claimed below therefore should not be limited except bythe actual language of the claims.

Articles are also described that comprise a tangibly embodiedmachine-readable medium operable to cause one or more machines (e.g.,computers, etc.) to result in operations described herein. Similarly,computer systems are also described that may include a processor and amemory coupled to the processor. The memory may include one or moreprograms that cause the processor to perform one or more of theoperations described herein.

The details of one or more variations of the subject matter describedherein are set forth in the accompanying drawings and the descriptionbelow. Other features and advantages of the subject matter describedherein will be apparent from the description and drawings, and from theclaims.

DESCRIPTION OF DRAWINGS

The accompanying drawings, which are incorporated in and constitute apart of this specification, show certain aspects of the subject matterdisclosed herein and, together with the description, help explain someof the principles associated with the disclosed implementations. In thedrawings,

FIG. 1 is a diagram illustrating features of an in-memory databaseserver;

FIG. 2 is a diagram illustrating features of a multi-tenant architectureusing an in-memory database server with multiple tenants per host;

FIG. 3 is a diagram illustrating features of a multi-tenant architectureusing an in-memory database server with a single tenant per host;

FIG. 4 is a diagram illustrating features of a distributed, in-memorysystem;

FIG. 5 is a diagram illustrating features of data sharing betweenin-memory database servers;

FIG. 6 is a diagram illustrating features of a system including a mastername server and slave name servers;

FIG. 7 is a diagram illustrating features of an architecture forreplication of central metadata;

FIG. 8 shows a tables illustrating division of data among tenants in anin-memory multi-tenant architecture;

FIG. 9 is a diagram illustrating features of a multi-tenant architecturein an in-memory database system

FIG. 10 is a diagram illustrating sharing of data and metadata in amulti-tenant architecture;

FIG. 11 shows a table listing features of different types of databasetables in an in-memory multi-tenant architecture; and

FIG. 12 is a process flow diagram illustrating aspects of a method.

When practical, similar reference numbers denote similar structures,features, or elements.

DETAILED DESCRIPTION

Previously available database management systems have typically beendesigned for optimizing performance on hardware with limited main memoryand with the slow disk input/output (I/O) as the main bottleneck. Thetypical focus in architecture design was on optimizing disk access, forexample by minimizing a number of disk pages to be read in to mainmemory when processing a query.

Computer architectures have changed substantially over time. Withmulti-core central processing units (CPUs), parallel processing ispossible with fast communication between processor cores, for examplevia main memory or one or more shared caches. Main memory is also muchless likely to be a limited resource thanks to ever decreasing costs.Servers with more than 2 TB RAM are currently available. Modern computerarchitectures create new possibilities but also new challenges. With allrelevant data in memory, disk access is no longer a limiting factor forperformance. Server processors can currently have up to 64 cores and 128cores will come in the near future. With the increasing number of cores,CPUs will able to process more and more data per time interval. Thus,the performance bottlenecks more commonly occur between the CPU cacheand main memory than due to disk read/write processes. Traditionaldatabases of online transaction processing systems typically do not makethe most efficient use of currently available hardware. In a memoryresident traditional database management system, the CPU can spend asmuch as half of its execution time in stalls, for example waiting fordata being loaded from main memory into the CPU cache.

To address these and potentially other issues with currently availablesolutions, one or more implementations of the current subject matterprovide methods, systems, articles or manufacture, and the like thatcan, among other possible advantages, provide a multi-tenancy softwarearchitecture employing in-memory database technologies and, in at leastsome implementations, cache aware memory, optimization, and execution;support for parallel execution; and the like.

In a software delivery configuration in which services provided to eachof multiple organizations are hosted on a dedicated system that isaccessible only to that organization, the software installation at thededicated system can be customized and configured in a manner similar tothe above-described example of a standalone, customized softwareinstallation running locally on the organization's hardware. However, tomake more efficient use of computing resources of the SaaS provider andto provide important performance redundancies and better reliability, itcan be advantageous to host multiple tenants on a single system thatincludes multiple servers and that maintains data for all of themultiple tenants in a secure manner while also providing customizedsolutions that are tailored to each tenant's business processes.

Such an approach can introduce several challenges. Making modificationsto the core software platform, for example updating to a new version,implementing a change to the core functionality, or the like, can becomea complicated and unpredictable process if each tenant's customized dataobjects and other tenant-specific configurations do not react in thesame manner to the modifications. Additionally, during a lifecyclemanagement event, such as for example an upgrade or update, manyapplication specific tasks may have to be executed in a multi-tenantsystem. One or more of these actions have to run on every businesstenant that exists in the multi-tenant system. However, to start a taskon a specific tenant, a user logon with password can be necessary,thereby requiring that the lifecycle management procedure have readyaccess to authentication information, such as for example user names andpasswords, for each tenant.

According to the current subject matter, all relevant data can be keptin main memory, so read operations can be executed without disk read andwrite operations. Disk-based index structures, for example, are notneeded for an in-memory database. Disk storage is still necessary tomake changes durable, but the required disk write operations can beperformed asynchronously in the background. In addition, disk storagecan be used to store aged data that is not needed during normaloperations.

Architectures consistent with the current subject matter can minimizethe number of CPU cache misses and avoid CPU stalls because of memoryaccess. One approach for achieving this goal is using column basedstorage in memory. Search operations or operations on one column can beimplemented as loops on data stored in contiguous memory arrays, whichcan result in high spatial locality of data and instructions, so theoperations can be executed completely in the CPU cache without costlyrandom memory accesses.

Recent improvements in CPU processing speed have generally not resultedfrom increased processor clock speeds. Rather, the number of processorcores has increased. To maximize efficiency, software must make use ofmulti core CPUs by allowing parallel execution and includingarchitectures that scale well with the number of cores. For datamanagement systems, it is advantageous to allow partitioning of data insections for which the calculations can be executed in parallel. Toensure scalability, sequential processing—for example enforced bylocking—can advantageously be avoided.

FIG. 1 shows a block diagram of an in-memory relational database server100 consistent with implementations of the current subject matter. Aconnection and session management component 102 of an in-memory databasesystem 104 creates and manages sessions and connections for the databaseclients 106. For each session a set of parameters 110 is maintained suchas for example auto commit settings or the current transaction isolationlevel. Once a session is established, database clients 106 can uselogical (e.g. SQL) statements to communicate with the in-memory databasesystem 104. For analytical applications the multidimensional querylanguage MDX can also be supported.

Each statement can be processed in the context of a transaction. Newsessions can be implicitly assigned to a new transaction. A transactionmanager 112 can coordinate transactions, control transactionalisolation, and keep track of running and closed transactions. When atransaction is committed or rolled back, the transaction manager 112 caninform the involved engines about this event so they can executenecessary actions. The transaction manager 112 can cooperate with apersistence layer to achieve atomic and durable transactions.

Requests received from the database clients 106 can be analyzed andexecuted by a set of request processing and execution control components116, which can include a request parser 120 that analyses a request froma database client 106 and dispatches it to a responsible component.Transaction control statements can, for example, be forwarded to thetransaction manager 112, data definition statements can be dispatched toa metadata manager 122 and object invocations can be forwarded to anin-memory object store 124. Data manipulation statements can beforwarded to an optimizer 126, which creates an optimized execution planthat is provided to an execution layer 130. The execution layer 130 canact as a controller that invokes the different engines and routesintermediate results to a next phase in execution of the execution plan.

Built-in support can be offered for domain-specific models (such as forfinancial planning) scripting capabilities that allow to runapplication-specific calculations inside NewDB. A scripting language,for example SQL Script 132, which is based on side effect free functionsthat operate on tables using SQL queries for set processing, can be usedto enable optimizations and parallelization. The MDX language 134 can beused to provide support for multidimensional queries. A planning engine136 can allow financial planning applications to execute basic planningoperations in the database layer. An example of a basic planningoperation is to create a new version of a data set as a copy of anexisting one while applying filters and transformations. For example,planning data for a new year can be created as a copy of the data fromthe previous year. This operation requires filtering by year andupdating the time dimension. Another example of a planning operation canbe a disaggregation operation that distributes target values from higherto lower aggregation levels based on a distribution function.

Features such as SQL Script 132, MDX 134, and planning engine 136operations can be implemented using a common infrastructure called acalculation engine 138. Metadata can be accessed via the metadatamanager component 122. Metadata can include a variety of objects, suchas for example definitions of relational tables, columns, views,indexes, SQL Script functions, object store metadata, and the like. Allof these types of metadata can be stored in a common catalog for allstores (in-memory row store, in-memory column store, object store, diskbased). Metadata can be stored in tables in row store. In multi-tenantsystems and in distributed systems, central metadata can be sharedacross servers and tenants as discussed in greater detail below. Howmetadata is stored and shared can be hidden from the components that usethe metadata manager 122.

One or more relational engines 140, for example an in-memory row store142, an in-memory column store 144, a disk-based store 146, and thein-memory object store 124 mentioned above can communicate with therequest processing and execution control components 116, the metadatamanager 122, and the in-memory persistence layer 114. The row store 142and column store 144 are each relational in-memory data engines that canstore data in a row-based or column-based way, respectively. Some data,such as for example tracing data, need not be kept in memory all thetime. The disk-based store 146 can handle such data. Data in thedisk-based store 146 can be primarily stored in disk storage 150 andonly moved to memory buffers (e.g the persistence layer 114 whenaccessed.

When a table is created, the table can be specified in the store inwhich it is located. Table can be moved to different stores at a timeafter their creation. Certain SQL extensions can optionally be availableonly for specific stores (such as for example the “merge” command for acolumn store). However, standard SQL can be used on all tables. It isalso possible to combine tables from different stores in one statement(e.g. using a join, sub query, union, or the like).

As row based tables and columnar tables can be combined in one SQLstatement, the corresponding engines must be able to consumeintermediate results created by the other. Two engines can differ in theway they process data. Row store operations, for example, can processdata in a row-at-a-time fashion using iterators. Column store operations(such as for example scan, aggregate, and so on) can require that theentire column is available in contiguous memory locations. To exchangeintermediate results, a row store can provide results to a column storematerialized as complete rows in memory while a column store can exposeresults using the iterator interface needed by a row store.

The persistence layer 114 can be responsible for durability andatomicity of transactions and can ensure that the database is restoredto the most recent committed state after a restart and that transactionsare either completely executed or completely undone. To achieve thisgoal in an efficient way, the persistence layer 114 can use acombination of write-ahead logs, shadow paging and save points. Thepersistence layer 114 can offer interfaces for writing and reading dataand can also contain a logger 152 that manages the transaction log. Logentries can be written implicitly by the persistence layer 114 when dataare written via a persistence interface or explicitly by using a loginterface.

An authorization manager 154 can be invoked by other components of thearchitecture to check whether a user has the required privileges toexecute the requested operations. Privileges can be granted to users orroles. A privilege grants the right to perform a specified operation(such as for example create, update, select, execute, and the like) on aspecified object (such as for example a table, view, SQL Scriptfunction, and the like). Analytic privileges that represent filters orhierarchy drill down limitations for analytical queries can also besupported. Analytical privileges can grant access to values with acertain combination of dimension attributes. This could for example beused to restrict access to a cube with sales data to values withdimension attributes such as region=“US” and year=“2010.”

Implementations of the current subject matter can include features ofdistributed architectures that provide multi-tenant support and datadistribution that enables scalability. Multi tenant support, asdescribed above, allows hosting multiple “virtual” systems inside onephysical system with isolation of the virtual systems from each other.The current subject matter supports tenant isolation on a databaselevel. In a multi-tenant implementation, isolation can be achieved byhaving separate database processes and separate disk volumes for thedifferent tenants. Thus, a multi-tenant architecture can be distributedacross multiple database server processes 102, such as that shown inFIG. 1.

As shown in the architecture 200 of the diagram shown in FIG. 2,multiple tenants 202, each isolated from one another and available to beaccessed by clients 106 within a separate organization 204 via a network206, can be hosted by the same host 210. A host 210 can be a virtualmachine on a larger system 212 or one or more physical processors.Tenants 202 can also be distributed across multiple host processes 210.Data distribution means that tables or ranges within tables are assignedto different database partitions that are assigned to different hostprocesses 210 for scalability reasons. Each tenant 202 can be served bya single database server process 102 accessing tenant data 214 for therespective tenant 202 that is isolated form all other tenants 202.

FIG. 3 shows an example of a system architecture 300 consistent with animplementation that includes data distribution for scalability reasons.Such a configuration can be used for large, on-premise or stand-alonesystems with high performance requirements. Each data server process 102and its associated data partition 302 is assigned to a discrete host210. Again, a host 210 can be a virtual machine on a larger system 212or one or more physical processors.

FIG. 4 shows a box diagram of a distributed, in-memory system 400consistent with at least one implementation of the current subjectmatter. A distributed system 212 can include multiple database servers102, each of which contains all or at least some of the components shownin FIG. 1 and described above. Each database server 102 can include aseparate operating system process and its own disk volume(s) 150. Thedatabase servers 102 of a distributed system 212 can be distributedacross multiple hosts 210, but it is also possible to run multipledatabase servers 102 on one host 210. During processing of databaseoperations, database servers 102 can forward the execution of someoperations to other database servers 102 that own data involved in theoperation.

In a data distribution scenario, for example without tenant separation,the database clients 106 need not know about the distribution. They maysend their requests to any database server 102. If the server 102 doesnot own all data involved, it can delegate the execution of someoperations to other database servers 102, collect the result and returnit to the database client 106. In a distributed system, execution planscan contain operations that are executed on remote servers 102. Theexecution control layer 116 of each database server 102 can connect tothe execution control layers 116 of other database servers 102 of thesame distributed system 212 to request remote execution of operations,such as for example as shown in the data exchange diagram 500 of FIG. 5.

In a distributed system, a central component, referred to herein as aname server 402 knows the topology of the system and how data isdistributed. In a multi-tenant system, the name server 402 also knowsthe assignment of tenants to the specific database servers 102. In asystem with data distribution, the name server 402 knows which tables orpartitions of tables are located on which database server 102. Adatabase server 102 processes a query by asking the name server 402about the locations of the involved tables.

Distributed transactions can be supported to ensure transactionalconsistency in distributed setups. Each system can have multipletransaction domains 404 to which the database servers 102 are uniquelyassigned. A distributed transaction may span only the database servers102 within the same transaction domain 404. In a transaction domain 404,one database server 102 can act as a transaction master, while the otherdatabase servers 102 act as transaction slaves.

In a transaction domain 404, transactions tokens or other containers forinformation needed to construct a consistent view for a transaction or astatement can be centrally managed by the transaction master 112. Insome implementations, a transaction token can be passed as an additionalcontext information to all operations and engines that are involved inthe execution of a statement. The transaction master 112 can alsomaintain a list of open transactions, increase timestamp sequences suchas transaction identifiers and commit identifiers, and coordinatedistributed commit operations.

To reduce the likelihood of such an inquiry resulting in a negativeimpact on performance, a copy 602 of the topology and distributioninformation 604 can be replicated and cached as a on each host 210.These data can be replicated to slave name servers 606 that run on eachhost 210. The slave name servers 606 can write the replicated data 602to a cache in shared memory from which any other database servers 102 onthe same host 210 can read the replicated data 602 (if the data belongto the same system). The block diagram in FIG. 6 shows an example with amaster name server 610 and slave name servers 606 on three differenthosts 210.

In a data distribution scenario, the partitioning can be done table wiseor also by splitting tables. With table wise partitioning, the mastername server 610 assigns new tables to a database server 102 based on thecurrent distribution of tables (number of tables assigned to eachdatabase server). Then data for this table will reside only on thatdatabase server 102. It is also possible to specify that a table issplit over multiple database servers 102. Partitioning of the table canbe done by the master name server 610 based on a size estimationspecified by the application. When records are inserted into a splittable, the records can be distributed to other database servers 102based on master name server 610 information. In a multi-tenant system,partitioning can be done according to tenant 202 as discussed in greaterdetail below.

The master name server 610 is a critical component in a distributedsystem. To ensure high availability, it is possible to have one or moreadditional name servers as backup master name servers. During normaloperation, the backup master name servers can receive all replicateddata like any slave name server 606. However, if the master name server610 fails, the backup server takes over the role of the master nameserver 610. If the system includes two or more backup master nameservers, the backup master name servers negotiate and one of them takesover the role of the master name server 610.

An example of an architecture 700 for replication of central metadata isshown in FIG. 7. Each database server 102 can contain a metadata manager122 that provides metadata related interfaces to other system components702. In a distributed system, metadata can be defined and storedcentrally and replicated to all database servers 102. Central metadata704 can be created in a specific database server having the role of thecentral metadata master 706. One central metadata master 706 can beincluded per system. On each other host 210, a local metadata master 710receives a copy 712 of the central metadata from the central metadatamaster 706. The local metadata master 710 makes the replicated metadataavailable to the database servers on the same host 210 using sharedmemory. These database servers are called metadata slaves 714. Metadataslaves 714 have only read access to the central metadata 704 or copy ofthe central metadata 712. The central metadata master 706 and localmetadata master 710 need not be separate server processes but rolesplayed by specific database servers. Metadata replication can be handledtransparently by the metadata managers 122. Other system components 702can use the metadata manager interface so the replication of metadatacan be completely hidden from them. For read access, metadatareplication can also be transparent for database clients 106. Regardlessof the database server to which a database client 106 is connected, thedatabase client 106 can read all central metadata 704.

Central metadata 704 can be created in the central metadata master 706.A database client 106 that needs to create or change central metadata704 can be required to connect to the metadata master 706 to do so.However, metadata can also be defined in the other database servers 102of an architecture. Such metadata is local to the database server 102where it is created and is not shared with others. This feature can beused for multi-tenant systems for defining metadata that is private to aspecific tenant.

Implementations of the current subject matter can support multipletenants 202 at the database level in a multi-tenant system. Tenants 202of one system share common metadata but for the actual tables that holdapplication data there are separate instances per tenant. FIG. 8 showstwo exemplary table structures 800 for a multi-tenant system includingthree tenants. Rather than storing data for all tenants in a commontable 802 having a tenant identifier column to indicate which entriesbelong to each tenant, each tenant can store its own data in a dedicatedtable 804, which does not needed a tenant specifier column.

FIG. 9 illustrates an example of a multi-tenant architecture 900 in anin-memory database system as described herein. A system supportingmultiple tenants can feature multiple database servers 102 where eachdatabase server 102 uniquely belongs to one tenant 202. In such aconfiguration, each tenant 202 runs in a different operating systemprocess 902 with its own virtual memory and also has its own disk volumeor volumes 904. As used herein, the term “tenant server” is used torefer to the database server 102 that belongs to a specific tenant 202.

According to at least one implementation, a system can include at leastone special tenant called the system tenant 906. The system tenant 906can be the meta data owner of a distributed system and can also containthe central metadata 704 available to all other tenants 202 for readaccess. Tenants 202 can also have their own private metadata 910 thatcan define tenant-dependent extensions in tenant-dependent tables 912that are based on standard tables defined by the central metadata 704.The tenant private metadata 910 can also define tenant private tables914. The system tenant 906 can contain tenant independent applicationdata stored in tenant independent tables 916 that can be read by alltenants 202. Normal (i.e. non-system) tenants are isolated from eachother. In the context of one tenant 202, data from other normal tenants920 cannot be accessed. If a client 106 needs access to more than onenormal tenant (for example a tenant management tool), it needs to openseparate database connections to each tenant 202. To improve tenantisolation, each tenant 202 can be assigned to its own transaction domain404 to ensure that a transaction is restricted to one tenant 202 andthat a single transaction cannot span multiple tenants 202, 914.

Having different disk volumes 904 for different tenants 202, 914 canfacilitate support for tenant operations such as tenant copy, tenantmove, tenant deletion, or the like. When relocating a tenant 202 to adifferent database server 102 in the same system, the tenant specificdisk volume 904 can be detached from the original database server 102and attached to the new database server 102. For moving or copyingtenants 202 between different systems, shared metadata can be handled byensuring that the tenant data to be moved is consistent with centralmetadata in the new system.

The block diagram 1000 shown in FIG. 10 illustrates how data andmetadata can be shared in a multi-tenant enabled system. In someimplementations, three categories of tables can exist in a multi-tenantin-memory system: tenant independent tables 916, tenant dependent tables912, and tenant private tables. Tenant independent tables 916 can existin a single instance per system with data and central metadata 704 asshared read-only information 1002 stored in the system tenant 906. Adatabase server 102 of a normal tenant 202, 920 has read access to thetenant independent tables 916. As noted above, tenant dependent tables912 can be defined centrally, e.g. by central metadata 704 stored in thesystem tenant 906. However, each tenant 202, 920 has its own instance ofthese tenant independent tables 916, which are not visible from othertenants 202, 920. For tenant private tables 914, both metadata andcontent are local to the tenant 202, 920.

The table 1100 of FIG. 11 further lists features of metadata and contentstorage and access for the three types of tables. When a table iscreated in a normal tenant 202, 920, it can be created as a tenantprivate table 914. Tenant independent tables 916 and tenant dependenttables 912 cannot be created in a normal tenant 202, 920. In the systemtenant 906, tables of all three types can be created. The desired typecan be specified when the table is created in the system tenant 906.

As stated above, a database client 106 can require multiple databaseconnections if it needs to access more than one tenant 202. However,sometimes applications need to combine tenant dependent tables 912 withtenant independent tables 916, which are stored in the system tenant, inone query—for example in a join operation, a sub query or a union. Toprocess this type of queries, the tenant servers 102 for normal tenants202, 920 have indirect read access to tenant independent tables 916(e.g. as noted by the dotted read arrows in FIG. 10). A database client106 that is connected to the database server 102 of a normal tenant 202,920 may combine tenant independent tables 916 and tenant dependenttables 912 in the same query. If a tenant database server 102 receivessuch a query, it can delegate the corresponding operations to thedatabase server 102 of the system tenant 906, combine the results withlocal results, and return them to the database client 106. In thismanner, the database clients need not be aware that the system tenant906 is involved in the query.

Because the system tenant 906 belongs to a different transaction domain404, a query that involves access to tenant independent tables 916 canbe executed using two different transactions. Therefore, transparentaccess to tenant independent tables 916 by a normal tenant 202, 920 islimited to read-only operations. If a database server 102 that isassigned to a normal tenant 202, 920 receives a request to modify thecontent of tenant independent tables 916, it reports an error. Adatabase client 106 that needs to write tenant independent tables 916must do so by opening a connection to the system tenant server 906.

If metadata is created in a normal tenant 202, 920, it can be stored inthe tenant 202, 920 as tenant private metadata 910. Tenant privatemetadata 910 can define tables, views, functions, and the like thatexist only in one tenant 202 and cannot be accessed from other tenants920. When reading metadata in the context of one tenant 202, 920, theresult can be created as the union of central metadata 704 and tenantprivate metadata 910. This process can be completed by one or moremetadata managers 112 and can be hidden from other system components702.

FIG. 12 shows a process flow chart 1200 illustrating features consistentwith implementations of the current subject matter. At 1202, anin-memory database server 102 hosting a tenant 202 of a multi-tenantsoftware architecture receives a definition of a custom data field thatis unique to an organization having isolated access to the tenant 202.The custom data field extends a standard table defined by centralmetadata 704 stored at a system tenant 906 of the multi-tenant softwarearchitecture. At 1204, tenant private metadata 910 that include thedefinition are stored in memory accessible only to the tenant 202. Atenant-dependent table 912 that includes the custom data field is formedat 1206. The forming includes retrieving central metadata 704 definingthe standard table from the system tenant 906 and adding the custom datafield using the definition. In additional optional features, a seconddefinition of a customized tenant private table 914 that is unique tothe tenant 202 can be received by the in-memory database server 102 at1210. At 1212, additional tenant private metadata 910 that include thesecond definition are stored in memory accessible only to the tenant202. At 1214, the tenant-dependent and/or private table can be presentedfor access via a database client 106 at the organization.

Aspects of the subject matter described herein can be embodied insystems, apparatus, methods, and/or articles depending on the desiredconfiguration. In particular, various implementations of the subjectmatter described herein can be realized in digital electronic circuitry,integrated circuitry, specially designed application specific integratedcircuits (ASICs), computer hardware, firmware, software, and/orcombinations thereof. These various implementations can includeimplementation in one or more computer programs that are executableand/or interpretable on a programmable system including at least oneprogrammable processor, which can be special or general purpose, coupledto receive data and instructions from, and to transmit data andinstructions to, a storage system, at least one input device, and atleast one output device.

These computer programs, which can also be referred to programs,software, software applications, applications, components, or code,include machine instructions for a programmable processor, and can beimplemented in a high-level procedural and/or object-orientedprogramming language, and/or in assembly/machine language. As usedherein, the term “machine-readable medium” refers to any computerprogram product, apparatus and/or device, such as for example magneticdiscs, optical disks, memory, and Programmable Logic Devices (PLDs),used to provide machine instructions and/or data to a programmableprocessor, including a machine-readable medium that receives machineinstructions as a machine-readable signal. The term “machine-readablesignal” refers to any signal used to provide machine instructions and/ordata to a programmable processor. The machine-readable medium can storesuch machine instructions non-transitorily, such as for example as woulda non-transient solid state memory or a magnetic hard drive or anyequivalent storage medium. The machine-readable medium can alternativelyor additionally store such machine instructions in a transient manner,such as for example as would a processor cache or other random accessmemory associated with one or more physical processor cores.

To provide for interaction with a user, the subject matter describedherein can be implemented on a computer having a display device, such asfor example a cathode ray tube (CRT) or a liquid crystal display (LCD)monitor for displaying information to the user and a keyboard and apointing device, such as for example a mouse or a trackball, by whichthe user may provide input to the computer. Other kinds of devices canbe used to provide for interaction with a user as well. For example,feedback provided to the user can be any form of sensory feedback, suchas for example visual feedback, auditory feedback, or tactile feedback;and input from the user may be received in any form, including, but notlimited to, acoustic, speech, or tactile input. Other possible inputdevices include, but are not limited to, touch screens or othertouch-sensitive devices such as single or multi-point resistive orcapacitive trackpads, voice recognition hardware and software, opticalscanners, optical pointers, digital image capture devices and associatedinterpretation software, and the like.

The subject matter described herein can be implemented in a computingsystem that includes a back-end component, such as for example one ormore data servers, or that includes a middleware component, such as forexample one or more application servers, or that includes a front-endcomponent, such as for example one or more client computers having agraphical user interface or a Web browser through which a user caninteract with an implementation of the subject matter described herein,or any combination of such back-end, middleware, or front-endcomponents. A client and server are generally, but not exclusively,remote from each other and typically interact through a communicationnetwork, although the components of the system can be interconnected byany form or medium of digital data communication. Examples ofcommunication networks include, but are not limited to, a local areanetwork (“LAN”), a wide area network (“WAN”), and the Internet. Therelationship of client and server arises by virtue of computer programsrunning on the respective computers and having a client-serverrelationship to each other.

The implementations set forth in the foregoing description do notrepresent all implementations consistent with the subject matterdescribed herein. Instead, they are merely some examples consistent withaspects related to the described subject matter. Although a fewvariations have been described in detail herein, other modifications oradditions are possible. In particular, further features and/orvariations can be provided in addition to those set forth herein. Forexample, the implementations described above can be directed to variouscombinations and sub-combinations of the disclosed features and/orcombinations and sub-combinations of one or more features further tothose disclosed herein. In addition, the logic flows depicted in theaccompanying figures and/or described herein do not necessarily requirethe particular order shown, or sequential order, to achieve desirableresults. The scope of the following claims may include otherimplementations or embodiments.

1-20. (canceled)
 21. A system comprising: at least one programmableprocessor; and at least one memory including program code, which whenexecuted by the at least one processor, causes the at least oneprogrammable processor to perform operations comprising: receiving, atan in-memory database server hosting a tenant of a multi-tenant softwaresystem, a definition of a custom data field that is unique to anorganization having isolated access to the tenant, the custom data fieldextending a standard table defined by central metadata stored at asystem tenant of the multi-tenant software system; forming atenant-dependent table comprising the custom data field, the formingcomprising retrieving, from the system tenant, central metadata definingthe standard table and adding, based on the received definition, thecustom data field; and accessing, via a database client at theorganization having isolated access to the tenant, the tenant-dependenttable.
 22. The system of claim 21, wherein the accessing furthercomprises presenting, via the database client at the organization havingisolated access to the tenant, the tenant-dependent table.
 23. Thesystem of claim 21, wherein the multi-tenant software system comprises aplurality of tenants hosted at a backend system, each tenant of theplurality of tenants comprising its own dedicated in-memory databaseserver having unique access to tenant-specific data, at least one of aplurality of database servers being provided via each of a plurality ofhosts on the backend system.
 24. The system of claim 23, wherein theplurality of database servers share the central metadata of the systemtenant.
 25. The system of claim 23, wherein the system tenant comprisesa central metadata master database server responsible for creating andmaintaining the central metadata, and wherein each host of the pluralityof hosts comprises a local metadata master database server that receivesa copy of the central metadata from the central metadata master databaseserver.
 26. The system of claim 21 further comprising storing, in memoryaccessible only to the tenant, tenant private metadata comprising thedefinition.
 27. A non-transitory computer-readable storage mediumincluding instructions which when executed by at least one programmableprocessor cause the at least one programmable processor to performoperations comprising: receiving, at an in-memory database serverhosting a tenant of a multi-tenant software system, a definition of acustom data field that is unique to an organization having isolatedaccess to the tenant, the custom data field extending a standard tabledefined by central metadata stored at a system tenant of themulti-tenant software system; forming a tenant-dependent tablecomprising the custom data field, the forming comprising retrieving,from the system tenant, central metadata defining the standard table andadding, based on the received definition, the custom data field; andaccessing, via a database client at the organization having isolatedaccess to the tenant, the tenant-dependent table.
 28. The non-transitorycomputer-readable storage medium of claim 27, wherein the accessingfurther comprises presenting, via the database client at theorganization having isolated access to the tenant, the tenant-dependenttable.
 29. The non-transitory computer-readable storage medium of claim27, wherein the multi-tenant software system comprises a plurality oftenants hosted at a backend system, each tenant of the plurality oftenants comprising its own dedicated in-memory database server havingunique access to tenant-specific data, at least one of a plurality ofdatabase servers being provided via each of a plurality of hosts on thebackend system.
 30. The non-transitory computer-readable storage mediumof claim 29, wherein the plurality of database servers share the centralmetadata of the system tenant.
 31. The non-transitory computer-readablestorage medium of claim 29, wherein the system tenant comprises acentral metadata master database server responsible for creating andmaintaining the central metadata, and wherein each host of the pluralityof hosts comprises a local metadata master database server that receivesa copy of the central metadata from the central metadata master databaseserver.
 32. The non-transitory computer-readable storage medium of claim27 further comprising storing, in memory accessible only to the tenant,tenant private metadata comprising the definition.
 33. Acomputer-implemented method comprising: receiving, at an in-memorydatabase server hosting a tenant of a multi-tenant software system, adefinition of a custom data field that is unique to an organizationhaving isolated access to the tenant, the custom data field extending astandard table defined by central metadata stored at a system tenant ofthe multi-tenant software system; forming a tenant-dependent tablecomprising the custom data field, the forming comprising retrieving,from the system tenant, central metadata defining the standard table andadding, based on the received definition, the custom data field; andaccessing, via a database client at the organization having isolatedaccess to the tenant, the tenant-dependent table.
 34. Thecomputer-implemented method of claim 33, wherein the accessing furthercomprises presenting, via the database client at the organization havingisolated access to the tenant, the tenant-dependent table.
 35. Thecomputer-implemented method of claim 33, wherein the multi-tenantsoftware system comprises a plurality of tenants hosted at a backendsystem, each tenant of the plurality of tenants comprising its owndedicated in-memory database server having unique access totenant-specific data, at least one of a plurality of database serversbeing provided via each of a plurality of hosts on the backend system.36. The computer-implemented method of claim 35, wherein the pluralityof database servers share the central metadata of the system tenant. 37.The computer-implemented method of claim 35, wherein the system tenantcomprises a central metadata master database server responsible forcreating and maintaining the central metadata, and wherein each host ofthe plurality of hosts comprises a local metadata master database serverthat receives a copy of the central metadata from the central metadatamaster database server.
 38. The computer-implemented method of claim 33,further comprising storing, in memory accessible only to the tenant,tenant private metadata comprising the definition.